User Account frequently getting locked Expand / Collapse
Author
Message
Posted 9/11/2012 1:09:16 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/11/2012 12:57:56 PM
Posts: 5, Visits: 0
Hello,

I Am facing issue of one of user account lockout, when I checked the Domain controller found logs that request are coming from Ms Exchange CAS/HUB server. On Exchange server I see Event 4634, 4624, 4648.

I am not able to trace the exact source, as this event tell network address as same Exchange server hostname. Please help to resolve this issue.

Post #1076
Posted 9/12/2012 5:58:00 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/11/2012 12:57:56 PM
Posts: 5, Visits: 0
Hi,

I am done all levels of troubleshooting..

Cleared IE cache

Checked for map drives

Checked for scheduled tasks

Checked all other scripts..

dint found anything...Hits coming from MS exchange CAS to DC, exchange CAS will come only when user accessing mail via OWA or mob..i have reconfigured his mob also but still hits coming...

Post #1081
Posted 9/19/2012 3:31:24 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/11/2012 12:57:56 PM
Posts: 5, Visits: 0
Hi,

Thanks for the information..its a useful info...

I have one issue with one more user but this time..authentication requests are coming from bluecoat proxy servers..we have 2 bluecoat proxy server and for every few secs 1 attempt of bad authentication is coming..I can see source workstation name is also a proxy server name...

I tries shutdown of user desktop..after shhutdown also attempts are coming...can you please let me know on bluecoat proxy server, where and what I can check to resolve...

I see Event ids..529 and 680

process using bacaa-130.exe

Post #1091
Posted 9/19/2012 12:59:34 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/19/2012 4:09:36 PM
Posts: 4, Visits: 4
i have also noticed account lockout issues with people using sync and exchange on iphone, etc and those passwords are manual on the device to change and they forgot to do it. Causes us admin types hours of troubleshooting because the netlogon logs dont say anything at all about the lockout location being exchange or certain device.
Post #1095
Posted 9/20/2012 10:53:50 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/11/2012 12:57:56 PM
Posts: 5, Visits: 0
any idea about bluecoat proxy authentication bacaa.exe, after uder reset password his old password request still going to domain controller which make every min user account is getting locked. Where I can stop this request going to dc..
Post #1101
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 8:59am